I am trying to integrate a WSE 3.0 client with our completed WCF STS and a WCF Sample Service. The WSE 3.0 client is able to retrieve the SAML token from the STS OK but when it tries to generate a secure conversation with the WCF Sample Service there is a failure on the WCF SampleService end.

The 1st error seemed to be because of DerivedKey tokens ('There was an error deserializing the security token XML. Please see the inner exception for more details.') in the SOAP message so I turned that to 'false'.

Then the WCF SampleService gave an error about the primary signature ('The primary signature must be encrypted.') - updating the message protection order from SignBeforeEncryptAndEncryptSignature to SignBeforeEncrypt resolved that issue.

Then the WCF SampleService gave the following error 'Cannot resolve KeyInfo for verifying signature: KeyInfo 'SecurityKeyIdentifier'.

After this I tried to not use secure conversation between the WSE 3.0 Client and WCF SampleService but then I got the error 'No signature message parts were specified for messages with the ' http://www.hide-link.com/ ' action.'

The config for the service is shown below

<system.serviceModel>

<services>

<service behaviorConfiguration="ServiceBehavior" name="SampleService.HelloWorldUserNameService">

<endpoint binding="customBinding" address="" bindingConfiguration="ServiceUserNameBinding" contract="SampleService.IHelloWorld"/>

</service>

<service behaviorConfiguration="ServiceBehavior" name="SampleService.HelloWorldX509Service">

<endpoint binding="customBinding" address="" bindingConfiguration="ServiceX509Binding" contract="SampleService.IHelloWorld"/>

</service>

</services>

<bindings>

<customBinding>

<binding name="MutualCertificateBinding">

<security authenticationMode="MutualCertificate"

requireSecurityContextCancellation="false"

requireSignatureConfirmation="false"

messageProtectionOrder="SignBeforeEncryptAndEncryptSignature"

requireDerivedKeys="true"

messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">

</security>

<!-- Required for WSE 3.0 clients -->

<textMessageEncoding messageVersion="Soap12WSAddressingAugust2004"/>

<httpTransport/>

</binding>

<binding name="ServiceUserNameBinding">

<security authenticationMode="SecureConversation">

<secureConversationBootstrap authenticationMode="IssuedToken"

messageProtectionOrder="SignBeforeEncrypt"

requireDerivedKeys="true"

requireSignatureConfirmation="false"

messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">

<issuedTokenParameters tokenType=" http://www.hide-link.com/ #SAMLV1.1">

<issuer address="http://localhost/SecurityTokenService/Service.svc" bindingConfiguration="MutualCertificateBinding" binding="customBinding">

<identity>

<dns value="WCFQuickstartServer"/>

</identity>

</issuer>

<issuerMetadata address="http://localhost/SecurityTokenService/Service.svc/Mex"/>

</issuedTokenParameters>

</secureConversationBootstrap>

</security>

<!-- Required for WSE 3.0 clients -->

<textMessageEncoding messageVersion="Soap12WSAddressingAugust2004"/>

<httpTransport/>

</binding>

<binding name="ServiceX509Binding">

<security authenticationMode="SecureConversation">

<secureConversationBootstrap authenticationMode="IssuedToken"

messageProtectionOrder="SignBeforeEncrypt"

requireDerivedKeys="true"

requireSignatureConfirmation="false"

messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">

<issuedTokenParameters tokenType=" http://www.hide-link.com/ #SAMLV1.1">

<issuer address="http://localhost/SecurityTokenService/ServiceX509.svc" bindingConfiguration="MutualCertificateBinding" binding="customBinding">

<identity>

<dns value="WCFQuickstartServer"/>

</identity>

</issuer>

<issuerMetadata address="http://localhost/SecurityTokenService/ServiceX509.svc/Mex"/>

</issuedTokenParameters>

</secureConversationBootstrap>

</security>

<!-- Required for WSE 3.0 clients -->

<textMessageEncoding messageVersion="Soap12WSAddressingAugust2004"/>

<httpTransport/>

</binding>

</customBinding>

</bindings>

<behaviors>

<serviceBehaviors>

<behavior name="ServiceBehavior">

<serviceCredentials type="Rover.Services.Sts.WebServiceCredentials, Rover.Services.Sts">

<serviceCertificate findValue="CN=WCFQuickstartServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName"/>

</serviceCredentials>

<serviceMetadata httpGetEnabled="true"/>

</behavior>

</serviceBehaviors>

</behaviors>

</system.serviceModel>

and the config for the WSE 3.0 Client is as follows (note that the WSE 3.0 client did work ok with a WSE 3.0 SAML token STS created earlier)